Method and device for determining attack behavior of charging pile network and electronic equipment

Abstract

The invention discloses a charging pile network attack behavior determination method and apparatus, and an electronic device. The method comprises the following steps: acquiring charging pile data in a charging pile system; extracting charging features corresponding to the charging pile data; the corresponding distances between the charging features and multiple target clustering center features are determined, multiple target distances are obtained, the multiple target clustering center features are obtained according to multiple initial clustering center features, and the multiple initial clustering center features are obtained according to subsample features included in the corresponding updating subspace; the plurality of updated subspaces are subspaces which are determined from the plurality of initial subspaces and have corresponding sample densities greater than a first threshold value; and determining an attack behavior category corresponding to the charging pile system according to the plurality of target distances. According to the method and the device, the technical problem of low attack detection accuracy when a traditional clustering detection method is used for detecting whether the charging pile network is attacked or not in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method, device and electronic device for determining attack behavior of a charging pile network. Background Art

[0002] At present, when detecting charging pile network attacks, the method usually adopted is to use the abnormal intrusion detection model built based on traditional clustering technology for detection. However, the traditional clustering detection method has the problem of low accuracy in the detection process and cannot adapt to the current reality of complex and changeable network attack links, resulting in the inability to guarantee the security of important information systems and information infrastructure of charging piles.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a method, device and electronic device for determining attack behavior of a charging pile network, so as to at least solve the technical problem in the related art that when using the traditional clustering detection method to detect whether the charging pile network is attacked, the attack detection accuracy is low.

[0005] According to one aspect of an embodiment of the present invention, a method for determining attack behavior of a charging pile network is provided, comprising: acquiring charging pile data in a charging pile system; extracting charging features corresponding to the charging pile data; determining distances corresponding to the charging features and multiple target cluster center features, respectively, to obtain multiple target distances, wherein the multiple target cluster center features are obtained based on multiple initial cluster center features, the multiple initial cluster center features are obtained based on subsample features included in corresponding update subspaces, the multiple update subspaces are subspaces whose corresponding sample densities are greater than a first threshold value determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features; based on the multiple target distances, determining the attack behavior category corresponding to the charging pile system.

[0006] Optionally, before determining the distances between the charging characteristics and the multiple target cluster center characteristics respectively and obtaining the multiple target distances, it also includes: determining multiple initial sample densities corresponding to the multiple initial subspaces respectively; comparing the multiple initial sample densities with the first threshold respectively to obtain multiple comparison results, wherein the multiple comparison results correspond one-to-one to the multiple initial sample densities; from the multiple comparison results, determining multiple target results of the subspace whose corresponding initial sample density is greater than the first threshold; determining the initial subspaces corresponding to the multiple target results to be multiple update subspaces.

[0007] Optionally, before determining the distances between the charging features and the multiple target cluster center features, and obtaining the multiple target distances, the method further includes: determining the densest subspace with the highest sample density from the multiple updated subspaces; determining the first initial cluster center feature based on the average distance of the charging pile sample points in the densest subspace; determining multiple initial distances corresponding to the first initial cluster center feature and the centers of multiple first residual subspaces, wherein the multiple first residual subspaces are the remaining subspaces in the multiple updated subspaces except the densest subspace; determining the long-distance subspace farthest from the first initial cluster center feature based on the multiple initial distances; determining the long-distance subspace based on the average distance of the charging pile sample points in the long-distance subspace; determining the long-distance subspace with the longest distance from the first initial cluster center feature; determining the long-distance subspace based on the average distance of the charging pile sample points in the long-distance subspace. Determine the second initial cluster center feature; determine the first distances corresponding to the first initial cluster center feature and the multiple second residual subspace centers, and determine the multiple second distances corresponding to the second initial cluster center feature and the multiple second residual subspace centers, wherein the multiple second residual subspace centers are the remaining subspaces in the multiple updated subspaces except the densest subspace and the distant subspace; determine the distance sums of the multiple first distances and the corresponding second distances, and obtain multiple distance sums; determine the third initial cluster center feature based on the multiple distance sums, until the multiple initial cluster center features are determined, wherein the third initial cluster center feature is the updated subspace center corresponding to the maximum distance sum.

[0008] Optionally, before determining the distances between the charging characteristics and the multiple target cluster center characteristics, and obtaining the multiple target distances, it also includes: determining, from the multiple initial subspaces, a subspace whose corresponding initial sample density is less than or equal to a first threshold, to obtain a centerless subspace; determining the sample distances between the multiple charging pile sample points included in the centerless subspace and the multiple initial cluster center characteristics; based on the multiple sample distances, clustering the multiple charging pile sample points into corresponding update subspaces, to obtain multiple target subspaces; based on the multiple target subspaces, obtaining multiple target cluster center characteristics, wherein the target subspaces correspond one-to-one to the target cluster center characteristics.

[0009] Optionally, after determining the attack behavior category corresponding to the charging pile system based on multiple target distances, it also includes: determining initial charging pile parameters corresponding to the charging pile system; and adjusting the initial charging pile parameters based on the attack behavior category to obtain target charging pile parameters.

[0010] Optionally, based on the attack behavior category, the initial charging pile parameters are adjusted to obtain the target charging pile parameters, including: determining a fitness function based on multiple target distances, wherein the fitness function is used to determine the probability that the charging pile system is attacked by the attack behavior category; determining a predetermined number of charging pile parameters to be selected based on the initial charging pile parameters and the fitness function, wherein the predetermined number of charging pile parameters to be selected are all parameters whose corresponding fitness is greater than a second threshold; and obtaining the target charging pile parameters based on the predetermined number of charging pile parameters to be selected.

[0011] Optionally, extracting the charging characteristics corresponding to the charging pile data includes: performing numerical processing on the charging pile data to obtain numerical charging pile data corresponding to the charging pile data; and performing normalization processing on the numerical charging pile data to obtain the charging characteristics.

[0012] According to one aspect of an embodiment of the present invention, there is provided an attack behavior determination device for a charging pile network, comprising: an acquisition module for acquiring charging pile data in a charging pile system; an extraction module for extracting charging features corresponding to the charging pile data; a first determination module for determining distances between the charging features and a plurality of target cluster center features, respectively, to obtain a plurality of target distances, wherein the plurality of target cluster center features are obtained based on a plurality of initial cluster center features, the plurality of initial cluster center features are obtained based on subsample features included in a corresponding update subspace, the plurality of update subspaces are subspaces whose corresponding sample densities are greater than a first threshold value determined from a plurality of initial subspaces, and the plurality of initial subspaces are obtained by clustering target sample features; a second determination module for determining the attack behavior category corresponding to the charging pile system based on the plurality of target distances.

[0013] According to one aspect of an embodiment of the present invention, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute instructions to implement any of the above-described methods for determining attack behaviors of a charging pile network.

[0014] According to one aspect of an embodiment of the present invention, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the above-mentioned methods for determining attack behaviors of a charging pile network.

[0015] In an embodiment of the present invention, the charging pile data in the charging pile system is obtained. The charging features corresponding to the charging pile data are extracted. The distances corresponding to the charging features and the features of the multiple target cluster centers are determined to obtain multiple target distances, wherein the multiple target cluster center features are obtained based on the multiple initial cluster center features, and the multiple initial cluster center features are obtained based on the sub-sample features included in the corresponding update subspaces. The multiple update subspaces are subspaces whose corresponding sample densities are greater than the first threshold value determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features. Based on the multiple target distances, the attack behavior category corresponding to the charging pile system is determined. It can be seen that the embodiment of the present invention determines the distances corresponding to the multiple target cluster centers of the charging features to achieve the purpose of determining the attack behavior category. Since the target cluster center is the center obtained after secondary clustering, the target cluster center feature is a more accurate and representative feature of the attack information represented by the corresponding subspace, that is, it can accurately indicate whether the corresponding subspace is under attack and what kind of attack it is under, so as to accurately determine the category of attack behavior by determining which cluster center the charging feature is similar to, thereby solving the technical problem of low attack detection accuracy when using traditional clustering detection methods to detect whether a charging pile network is under attack in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a method for determining attack behavior of a charging pile network according to an embodiment of the present invention;

[0018] Figure 2 is a flowchart of charging pile attack detection based on an improved multi-clustering method provided by an optional embodiment of the present invention;

[0019] Figure 3 It is a flow chart of an improved multi-cluster charging pile network attack security protection system provided by an optional embodiment of the present invention;

[0020] Figure 4 is a flow chart of an improved gray wolf optimization algorithm provided by an optional implementation mode of the present invention;

[0021] Figure 5 4 is a structural block diagram of an attack behavior determination device for a charging pile network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] Example 1

[0025] According to an embodiment of the present invention, an embodiment of a method for determining attack behavior of a charging pile network is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0026] Figure 1 is a flow chart of a method for determining attack behavior of a charging pile network according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0027] Step S102, acquiring charging pile data in the charging pile system.

[0028] In step S102 provided in the present application, charging pile data in the charging pile system is obtained.

[0029] Among them, the charging pile system is involved. The charging pile system refers to the network system that provides charging services for electric vehicles. It can include charging pile equipment, charging management software, payment system, monitoring system, etc.

[0030] Among them, charging pile data is involved. Charging pile data refers to various data generated by the charging pile system during operation, which may include but is not limited to charging pile network traffic, security logs, monitoring videos, charging amount, charging time, charging frequency, user information, payment information, device status, network traffic data, security logs, etc., among which network traffic includes various data packets transmitted through the network, and security logs include security log records of various network devices and systems.

[0031] In this step, acquiring charging pile data in the charging pile system means collecting real-time or historical charging pile data from the charging pile system. This is a basic step in detecting charging pile network attacks, because only when sufficient data is obtained can possible attack behaviors be identified through data analysis methods.

[0032] It should be noted that data acquisition can be achieved through a variety of methods such as sensors installed on the charging pile, network traffic monitoring tools, user operation log recording systems, etc., to ensure that the system can fully understand the operating status of the charging pile and user operations. The specific method is not limited here and can be adaptively set according to actual applications and scenarios.

[0033] Step S104, extracting charging characteristics corresponding to the charging pile data.

[0034] In step S104 provided in the present application, the charging characteristics corresponding to the charging pile data are extracted.

[0035] Among them, charging characteristics are involved. Charging characteristics are key indicators or attributes extracted from charging pile data that can describe the characteristics of the charging process. These characteristics can be charging time, charging power curve, charging frequency, charging pile usage time distribution, etc. They are of great significance for judging whether the charging behavior is normal and whether there are potential safety issues.

[0036] In this step, the charging features corresponding to the charging pile data are extracted, that is, the key attributes directly related to the charging process are identified from the data collected by the charging pile system. This process may involve steps such as data cleaning, removal of irrelevant information, standardization, normalization, and feature selection, with the aim of converting the original charging pile data into a feature set suitable for data analysis and machine learning models. For example, charging features may include the peak charging hours of the day, the changing patterns of current and voltage during charging, and the user's charging habits.

[0037] By extracting charging features, cyberattacks can be identified more accurately. For example, if a charging station has abnormally high current or voltage during non-peak charging hours, or if a user's charging behavior changes suddenly, these may be signs of a cyberattack or other security threats. Feature extraction enables the model to make judgments based on these specific indicators, improving the accuracy and sensitivity of detection.

[0038] Step S106, determine the distances between the charging features and the multiple target cluster center features, and obtain multiple target distances, wherein the multiple target cluster center features are obtained based on the multiple initial cluster center features, the multiple initial cluster center features are obtained based on the sub-sample features included in the corresponding update subspace, the multiple update subspaces are subspaces whose corresponding sample densities are greater than the first threshold determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features.

[0039] In step S106 provided in the present application, the distances corresponding to the charging features and the multiple target cluster center features are determined to obtain multiple target distances.

[0040] Among them, the target cluster center is involved. The target cluster center feature is determined after the secondary clustering process and represents the center point of the normal operation behavior of the charging pile. Through these center points, the samples in the data set can be compared with the normal behavior.

[0041] Among them, multiple target distances are involved. Multiple target distances refer to the distances between charging features and multiple target cluster center features. In cluster analysis, these distances are used to measure the similarity between the current feature point and the cluster center feature. The smaller the distance, the closer the sample point is to the cluster center, that is, the more it conforms to the corresponding behavior of the corresponding subspace.

[0042] Among them, multiple initial cluster center features are involved. Multiple initial cluster center features are center point features determined in the first clustering operation, which are usually based on the initial sample distribution in the data set and are used to preliminarily divide the data set into different clusters.

[0043] Therein, multiple update subspaces are involved. In the secondary clustering process, the system analyzes the initial subspace and determines the subspace whose sample density is greater than the first threshold.

[0044] Among them, the target sample features are involved. The target sample features refer to the sample features that are analyzed and clustered in the charging pile network. These features should be able to describe the key aspects of the use of charging piles, such as charging time, charging frequency, charging power, network traffic, etc. The target sample features are the basis of cluster analysis. By clustering these features, the features that represent the same attack behavior can be grouped into an initial subspace, so as to form multiple initial subspaces that reflect different attack behaviors.

[0045] Among them, multiple initial subspaces are involved. Multiple initial subspaces refer to multiple subspaces obtained by clustering the target sample features. This operation is usually to perform cluster analysis more efficiently. Each subspace can contain some features in the feature set to reflect different attack behaviors.

[0046] Among them, sub-sample features are involved. Sub-sample features are concepts related to multiple initial subspaces, and refer to the sample features included in each subspace.

[0047] Among them, the first threshold is involved, which is a parameter used to screen high-density subspaces in the clustering process. By setting the first threshold, subspaces with low sample density and that may contain abnormal or irrelevant data can be filtered out, thereby improving the accuracy of the clustering effect.

[0048] In this step, the distances corresponding to the charging features and the features of multiple target cluster centers are directly determined. Since the target cluster center is the center obtained after secondary clustering, the target cluster center feature is a more accurate and representative feature of the attack information represented by the corresponding subspace, that is, it can accurately indicate whether the corresponding subspace is attacked and what kind of attack it is, so as to accurately determine the attack behavior category by determining which cluster center the charging features are similar to. That is, through the use of secondary clustering and updating subspaces, the system can more accurately identify the attack behavior category, thereby improving the accuracy of attack category detection.

[0049] Step S108, determining the attack behavior category corresponding to the charging pile system according to the multiple target distances.

[0050] In step S108 provided in the present application, the attack behavior category corresponding to the charging pile system is determined based on multiple target distances.

[0051] Among them, the attack behavior category is involved. The attack behavior category refers to the classification of potential network attacks into different types based on the abnormal detection results of the charging pile network data, such as denial of service (DoS) attacks, man-in-the-middle (MITM) attacks, malware propagation, etc. By identifying the attack behavior category, specific security measures can be taken to deal with different types of threats.

[0052] In this step, the attack behavior category corresponding to the charging pile system is determined based on multiple target distances, that is, the system calculates the distance between each charging feature and all target cluster centers, and determines whether the charging feature belongs to the known attack behavior pattern based on the size and distribution characteristics of these distances. If a charging feature is very close to a specific cluster center, the system can mark it as the corresponding attack behavior category.

[0053] Through the above steps S102-S108, the charging pile data in the charging pile system is obtained. The charging features corresponding to the charging pile data are extracted. Determine the distances between the charging features and the multiple target cluster center features, and obtain multiple target distances, wherein the multiple target cluster center features are obtained based on the multiple initial cluster center features, and the multiple initial cluster center features are obtained based on the sub-sample features included in the corresponding update subspace, and the multiple update subspaces are subspaces whose corresponding sample densities are greater than the first threshold determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features. Based on the multiple target distances, determine the attack behavior category corresponding to the charging pile system. It can be seen that the embodiment of the present invention determines the distances between the charging features and the multiple target cluster centers, so as to achieve the purpose of determining the attack behavior category. Since the target cluster center is the center obtained after secondary clustering, the target cluster center feature is a more accurate and representative feature of the attack information represented by the corresponding subspace, that is, it can accurately indicate whether the corresponding subspace is under attack and what kind of attack it is under, so as to accurately determine the category of attack behavior by determining which cluster center the charging feature is similar to, thereby solving the technical problem of low attack detection accuracy when using traditional clustering detection methods to detect whether a charging pile network is under attack in related technologies.

[0054] As an optional embodiment, extracting charging characteristics corresponding to charging pile data includes: performing numerical processing on the charging pile data to obtain numerical charging pile data corresponding to the charging pile data; and performing normalization processing on the numerical charging pile data to obtain charging characteristics.

[0055] In this embodiment, further steps of extracting charging features corresponding to charging pile data are described.

[0056] Among them, the charging pile numerical data is involved, which refers to the process result of converting the non-numerical information in the charging pile data into a numerical format. For example, converting the charging status described in text into a binary value of 0 or 1, converting the geographic location information into latitude and longitude values, and converting the timestamp into a calculable time difference value.

[0057] In the steps involved in this embodiment, the non-numerical information in the charging pile data is first converted into a numerical format so that the computer algorithm can process it. For example, the geographical location of the charging pile is converted into a latitude and longitude value, and the timestamp in the user operation record is converted into a time difference value with a certain reference point. Numerical processing is an important step in data preprocessing. It converts unstructured information into structured numerical data, which is convenient for subsequent data analysis and algorithm model processing. Next, the numerical data of the charging pile is normalized, that is, the values ​​of all features are scaled to the same range, usually [0, 1]. Normalization helps to eliminate the influence of different feature scales, ensure that all features are at the same level in subsequent cluster analysis and model training, avoid large-scale features dominating the behavior of the model, and improve the stability and prediction accuracy of the model. The normalized data are charging features, which will be used for subsequent attack detection and behavior analysis.

[0058] In this way, the data format after digitization and normalization is unified, which is convenient for rapid processing and analysis, reduces the complexity of algorithm calculation, and improves the speed of detection and response. Moreover, normalization ensures that the model is not affected by the feature scale when processing data, improves the accuracy of the model's analysis of charging pile data, and reduces the risk of false positives and false negatives. In addition, digitization converts complex data into a simple numerical format, which is convenient for feature selection and engineering, reduces the difficulty of feature selection, and improves the effectiveness of features.

[0059] As an optional embodiment, before determining the distances between the charging characteristics and the multiple target cluster center characteristics and obtaining the multiple target distances, it also includes: determining multiple initial sample densities corresponding to the multiple initial subspaces; comparing the multiple initial sample densities with the first threshold to obtain multiple comparison results, wherein the multiple comparison results correspond one-to-one to the multiple initial sample densities; determining from the multiple comparison results, multiple target results of the subspace whose corresponding initial sample density is greater than the first threshold; and determining that the initial subspaces corresponding to the multiple target results are multiple update subspaces.

[0060] In this embodiment, the steps of determining multiple update subspaces before determining the distances between charging features and multiple target cluster center features and obtaining multiple target distances are described.

[0061] Among them, the initial sample density is involved. The initial sample density refers to the distribution density of sample features in each initial subspace, that is, the number of sample features per unit space. High-density subspaces usually represent areas where sample points are concentrated.

[0062] The first threshold is a set numerical standard used to filter out high-density subspaces. Only when the sample density of the initial subspace exceeds the first threshold, the subspace will be considered as an updated subspace for subsequent clustering analysis.

[0063] In the steps involved in this embodiment, first, multiple initial sample densities corresponding to multiple initial subspaces are determined, that is, the density of charging pile data points in the subspace. Then, each initial sample density is compared with a preset first threshold to obtain a comparison result. Only those subspaces whose sample density exceeds the first threshold, that is, high-density subspaces, will be further retained as update subspaces for subsequent clustering analysis and anomaly detection.

[0064] In this way, the screening of high-density subspaces helps to exclude noise and irrelevant data in low-density areas, improving the accuracy of clustering results. Moreover, by screening and retaining only high-density subspaces, the computing resource requirements for subsequent clustering and anomaly detection can be significantly reduced, improving overall processing efficiency and response speed. In addition, the use of updated subspaces enhances the system's ability to adapt to changes in charging pile network data, and maintains high clustering accuracy and anomaly detection capabilities even in the presence of noise or anomalies.

[0065] It should be noted that the first threshold can be dynamically adjusted according to the real-time status and historical data of the charging pile network to adapt to different data distribution and load conditions, thereby improving the flexibility and accuracy of screening. In addition, real-time stream data processing technology can be combined to achieve real-time update subspace screening and cluster analysis, thereby enhancing the real-time response and protection capabilities of the charging pile network. Furthermore, the cluster analysis based on the update subspace can be integrated with a deep learning model (such as a convolutional neural network CNN and a long short-term memory network LSTM), and the feature extraction and pattern recognition capabilities of the deep learning model can be used to further improve the accuracy and robustness of anomaly detection in the charging pile network. Also, when performing subspace screening and sample density calculation, attention should be paid to data security and privacy protection, and technologies such as data desensitization and differential privacy can be used to ensure that sensitive information is not leaked.

[0066] As an optional embodiment, before determining the distances between the charging characteristics and the characteristics of multiple target cluster centers, and obtaining multiple target distances, it also includes: determining the densest subspace with the highest sample density from multiple updated subspaces; determining the first initial cluster center feature based on the average distance of the charging pile sample points in the densest subspace; determining multiple initial distances corresponding to the first initial cluster center feature and the centers of multiple first residual subspaces, wherein the multiple first residual subspaces are the remaining subspaces in the multiple updated subspaces except the densest subspace; determining the long-distance subspace with the farthest distance from the first initial cluster center feature based on the multiple initial distances; determining the long-distance subspace with the farthest distance from the charging pile sample points in the long-distance subspace The average distance of is used to determine the second initial cluster center feature; determine the first distances corresponding to the first initial cluster center feature and the multiple second residual subspace centers, and determine the multiple second distances corresponding to the second initial cluster center feature and the multiple second residual subspace centers, wherein the multiple second residual subspace centers are the remaining subspaces in the multiple updated subspaces except the densest subspace and the distant subspace; determine the distance sums of the multiple first distances and the corresponding second distances to obtain multiple distance sums; determine the third initial cluster center feature based on the multiple distance sums, until multiple initial cluster center features are determined, wherein the third initial cluster center feature is the updated subspace center corresponding to the maximum distance sum.

[0067] In this embodiment, the step of determining the distances corresponding to the charging characteristics and the plurality of target cluster center characteristics respectively and determining the plurality of initial cluster center characteristics before obtaining the plurality of target distances is described.

[0068] Among them, the densest subspace is involved. The densest subspace refers to the update subspace that includes the most sample features among multiple update subspaces. That is, the densest subspace is the subspace with the highest sample density selected from multiple update subspaces. It usually represents the most typical and frequent attack behavior category in the charging pile network.

[0069] Among them, the first initial cluster center feature is involved, and the first initial cluster center feature represents the center feature of multiple charging features included in the densest subspace. The center feature of this space is determined in the updated subspace including the most charging features, and is used as the first initial cluster center feature. Since the subspace with the largest sample density includes the most features, the center feature determined in this way is representative and can better capture the clustering characteristics and structure of the data, thereby improving the accuracy and quality of clustering.

[0070] The first residual subspace is involved, and the first residual subspace represents the remaining subspace in multiple update subspaces except the densest subspace.

[0071] Among them, the distant subspace is involved. The distant subspace represents the updated subspace with the farthest distance from the first initial cluster center feature in multiple updated subspaces. The distant subspace is selected from the first residual subspace and is the subspace with the farthest distance from the first initial cluster center feature. It may represent another type of attack behavior in the charging pile network.

[0072] Among them, the second initial cluster center feature is involved, and the second initial cluster center feature represents the central feature of multiple charging features included in the long-distance subspace. Select the updated subspace farthest from the first initial cluster center feature, determine the central feature of this space, and use it as the second initial cluster center feature. In this way, the distance between the two initial cluster center features can be maximized, so that the cluster centers are more evenly distributed in multiple updated subspaces, increasing the diversity and separation of clusters, helping to better distinguish different cluster groups, reduce the overlap of different cluster groups, and make the results more stable and reliable.

[0073] The second residual subspace center represents the remaining subspaces among multiple updated subspaces except the densest subspace and the distant subspace.

[0074] Among them, the first distance and the second distance are involved. The first distance represents the distance from the first initial cluster center feature to the centers of multiple second residual subspaces, and the second distance represents the distance from the second initial cluster center feature to the centers of multiple second residual subspaces. That is, the first distance and the second distance refer to the distance between the charging pile sample point and the first initial cluster center feature and the second initial cluster center feature, respectively, and are used to measure the similarity between the sample point and the cluster center.

[0075] Among them, the third initial cluster center feature represents the center feature of multiple charging features included in the maximum updated subspace of the distance and the distance corresponding to the second distance. After determining the first initial cluster center feature and the second initial cluster center feature, determine the distance sum of multiple first distances and their corresponding second distances, obtain multiple distance sums, and determine the maximum distance and corresponding subspace center feature as the third initial cluster center feature. In this way, the distance between different clusters is maximized, so that each cluster center feature is evenly distributed in the data space, which is conducive to better representing different cluster groups and increasing the stability and accuracy of the detection results.

[0076] In the steps involved in this embodiment, the densest subspace with the highest sample density is first identified from multiple updated subspaces. This step ensures that the selection of cluster centers is based on the densest and most typical attack behavior category in the charging pile network data. Then, the average distance of the charging pile sample points in the densest subspace is calculated as the first initial cluster center feature. This step provides the center point of a certain type of attack behavior in the charging pile network. Next, the long-distance subspace with the farthest distance from the first initial cluster center feature is found from the first remaining subspace, and this is used as the second initial cluster center feature. This step helps to expand the scope of cluster analysis and ensure that more types of attack behaviors can be covered. Then, the distances to the first initial cluster center feature and the second initial cluster center feature are calculated from the centers of multiple second remaining subspaces to form a distance sum, which is used to determine the third initial cluster center feature until multiple initial cluster center features are determined to ensure that all major attack behavior categories in the charging pile network are covered.

[0077] In this way, clustering accuracy can be improved. By selecting the initial cluster center features from the high-density subspace and then determining multiple initial cluster center features, the error in the clustering process can be effectively reduced and the accuracy of the clustering results can be improved. In addition, the comprehensive selection of the initial cluster center using sample density and distance criteria can enhance the clustering algorithm's ability to resist anomalies and noise in the charging pile network data and improve the robustness of the algorithm. In addition, through the above steps, the cluster centers can be gradually screened and optimized to ensure that each determined cluster center is optimal, and the amount of data required for detailed cluster analysis is reduced, thereby improving the overall computing efficiency and response speed.

[0078] As an optional embodiment, before determining the distances between the charging characteristics and the multiple target cluster center characteristics, and obtaining the multiple target distances, it also includes: determining, from the multiple initial subspaces, a subspace whose corresponding initial sample density is less than or equal to a first threshold, to obtain a centerless subspace; determining the sample distances between the multiple charging pile sample points included in the centerless subspace and the multiple initial cluster center characteristics; based on the multiple sample distances, clustering the multiple charging pile sample points into corresponding update subspaces, to obtain multiple target subspaces; based on the multiple target subspaces, obtaining multiple target cluster center characteristics, wherein the target subspaces correspond one-to-one to the target cluster center characteristics.

[0079] In this embodiment, the step of determining the distances corresponding to the charging characteristics and the plurality of target cluster center characteristics respectively and obtaining the plurality of target distances before determining the plurality of target cluster center characteristics is described.

[0080] Among them, the centerless subspace is involved, which means the subspaces in the multiple initial subspaces except the update subspace. That is, the centerless subspace refers to those subspaces whose initial sample density is less than or equal to the first threshold in the preliminary screening. These subspaces may contain sparse areas in the charging pile network, that is, areas where data points are more dispersed.

[0081] Among them, the target subspace is involved, which means the multiple subspaces formed by clustering multiple charging features in the centerless subspace into the corresponding update subspace. That is, the target subspace refers to the new subspace set finally obtained by re-clustering multiple charging pile sample points in the centerless subspace into the update subspace. These subspaces will be used as more refined analysis units in the subsequent cluster analysis.

[0082] Among them, the sample distance is involved. The sample distance refers to the distance between the charging pile sample point and the initial cluster center feature. The sample distance is used to measure the similarity between the sample point and the cluster center, and is a key factor in determining the attribution of the sample point.

[0083] Among them, the target cluster center characteristics are also involved. The target cluster center characteristics refer to the new cluster centers formed in the target subspace. Through continuous iteration and optimization, the target cluster center characteristics will more accurately reflect the attack behavior categories of the charging pile network.

[0084] In the steps involved in this embodiment, a subspace with a sample density less than or equal to a first threshold is screened out from multiple initial subspaces, that is, a centerless subspace. These subspaces may not be included in the high-density update subspace, but may still contain valuable information, especially when it comes to abnormal or rare attack behaviors. Then, the sample distance between the charging pile sample point and the multiple initial cluster center features in the centerless subspace is determined, that is, the similarity between the sample point and the existing cluster center is judged by calculating the distance. Based on these sample distances, the multiple charging pile sample points are re-clustered into the corresponding update subspace to obtain multiple target subspaces. This step compares the data points in the sparse area with the cluster centers in the high-density area and reasonably assigns them to more suitable clusters. Then, based on multiple target subspaces, new target cluster center features are determined. This process may involve multiple iterations until the cluster center is stable, ensuring that all major attack types in the charging pile network are covered and identified.

[0085] In this way, the comprehensiveness of cluster analysis can be ensured, that is, by processing sample points in the centerless subspace, it can be ensured that the cluster analysis covers all areas in the charging pile network, avoiding the sample points in the low-density area from being ignored, and improving the comprehensiveness and accuracy of the clustering results. It can also enhance the ability to detect abnormal behaviors. Sample points in the centerless subspace often represent relatively rare or abnormal behavior patterns. By clustering them into the target subspace, these abnormal behaviors can be more effectively identified, and the system's ability to detect potential attacks can be improved. Furthermore, by giving priority to processing high-density subspaces and then processing sample points in the centerless subspace, computing resources can be reasonably allocated to avoid wasting too many resources on computationally intensive cluster analysis. Moreover, since the re-clustering causes the central features of the target subspace to shift, it is necessary to re-determine the central features so that the target cluster central features better represent the respective cluster groups, optimize the clustering results, and improve the clustering quality.

[0086] As an optional embodiment, after determining the attack behavior category corresponding to the charging pile system based on multiple target distances, it also includes: determining the initial charging pile parameters corresponding to the charging pile system; based on the attack behavior category, adjusting the initial charging pile parameters to obtain the target charging pile parameters.

[0087] In this embodiment, after determining the attack behavior category corresponding to the charging pile system according to multiple target distances, the initial charging pile parameters of the charging pile system are adjusted to obtain the target charging pile parameters.

[0088] Among them, the initial charging pile parameters are involved, that is, a series of parameters set before the charging pile system, including but not limited to charging power, charging rate, communication frequency, safety threshold, data collection frequency, etc.

[0089] Among them, the target charging pile parameters are also involved. After identifying the attack behavior category, the charging pile system adjusts the initial charging pile parameters according to the specific attack behavior. The target charging pile parameters are a set of adjusted parameters to enhance the system's defense capabilities against attacks or optimize operating efficiency in an attack environment.

[0090] In the steps involved in this embodiment, the system determines the initial charging pile parameters required for its normal operation based on the current operating state. These parameters may be set to optimal values ​​to ensure efficient and safe operation under normal conditions. Then, when the charging pile network detection system identifies a specific attack behavior category, the charging pile system will adjust its initial charging pile parameters according to the type and characteristics of the attack. For example, in the face of a DoS attack, the charging pile system may increase its security threshold or adjust other parameters; in the face of a data tampering attack, the system may increase the frequency of data collection and increase data integrity checks to quickly identify and respond to potential security threats, etc., which are not limited here. More specifically, the attack behavior category is specifically set to obtain the target charging pile parameters to better defend against network attacks corresponding to the attack behavior category.

[0091] In this way, by adjusting the charging pile parameters to respond to specific attack behaviors, the charging pile system can take more accurate and effective defense measures, improving its adaptive security protection capabilities. Moreover, while defending against network attacks, adjusting the charging pile parameters can also optimize the operating efficiency of the charging pile in an attack environment, avoid unnecessary waste of resources, and ensure the continuity and quality of charging services. In addition, the setting of target charging pile parameters can increase the system's resistance to unknown or future network attacks, and the charging pile system can maintain its basic functions and security even in a complex and changing network environment.

[0092] As an optional embodiment, based on the attack behavior category, the initial charging pile parameters are adjusted to obtain the target charging pile parameters, including: determining a fitness function based on multiple target distances, wherein the fitness function is used to determine the probability that the charging pile system is attacked by the attack behavior category; determining a predetermined number of charging pile parameters to be selected based on the initial charging pile parameters and the fitness function, wherein the predetermined number of charging pile parameters to be selected are all parameters with corresponding fitness greater than a second threshold; and obtaining the target charging pile parameters based on the predetermined number of charging pile parameters to be selected.

[0093] In this embodiment, specific steps of adjusting the initial charging pile parameters and obtaining the target charging pile parameters based on the attack behavior category are described.

[0094] Among them, the fitness function is involved. The fitness function is a core concept in the optimization algorithm, which is used to measure the effectiveness of parameter configuration in solving specific problems. In the scenario of charging pile security protection, the fitness function is used to calculate the probability of the charging pile system being attacked by a network attack under a given parameter configuration, that is, the sensitivity of the attack. That is, in this scenario, the fitness function can determine the probability that a set of charging pile parameters will cause the charging pile system to be attacked by a category of attack behavior during the automatic response of the charging pile system to the network attack behavior.

[0095] Among them, the second threshold is involved. The second threshold is another set numerical standard used to screen out charging pile parameter configurations with higher adaptability, that is, those parameters that can effectively reduce the probability of attack.

[0096] Among them, the parameters of the charging pile to be selected are involved. The parameters of the charging pile to be selected are a set of parameters that have been evaluated by the fitness function and have a fitness greater than a second threshold. These parameters are considered to be a better operating configuration for the charging pile system when it is attacked.

[0097] Among them, the target charging pile parameters are involved. The target charging pile parameters are the optimal parameter set further determined from the charging pile parameters to be selected, and are used to actually adjust the charging pile system to enhance its safety protection capabilities.

[0098] In the steps involved in this embodiment, a fitness function is constructed based on multiple target distances. This function helps the system evaluate the security of different parameter configurations by quantifying the possibility of the charging pile system being attacked under different parameter configurations. Then, the system uses the initial charging pile parameters and the fitness function to screen out the charging pile parameters to be selected with a fitness higher than the second threshold through an optimization algorithm. The setting of the second threshold can ensure that only those parameter configurations that can obviously reduce the probability of attack will be further considered, thereby avoiding unnecessary parameter adjustments. Finally, the system determines the optimal target charging pile parameters from these charging pile parameters with higher fitness through further optimization or selection. These parameters will be actually applied to the charging pile system, in order to reduce the risk of network attacks while ensuring service quality and efficiency.

[0099] In this way, the system security can be improved, that is, by adjusting the charging pile parameters to reduce the probability of being attacked by the network, the system can actively optimize its operating status and enhance its defense against network attacks. In addition, the parameter configuration with high fitness is selected to avoid unnecessary waste of resources, ensuring that the charging service is running efficiently while ensuring safety protection. In addition, the setting of the fitness function enables the charging pile system to adaptively adjust its parameters according to the type and intensity of the network attack, improving the flexibility and robustness of the system.

[0100] Based on the above embodiments and optional embodiments, an optional implementation is provided, which is described in detail below.

[0101] An optional implementation of the present invention provides a method for determining attack behavior of a charging pile network. Figure 2 This is the charging pile attack detection process based on the improved multi-clustering method in this application, such as Figure 2 As shown, based on the obtained charging pile data set, the target distance can be obtained through the improved K-means clustering algorithm and the improved evidence accumulation clustering algorithm, and finally it can be judged whether the charging pile operation behavior is abnormal and the type of attack behavior can be determined.

[0102] The specific steps involved in the optional implementation manner of the present invention are introduced below.

[0103] S1. Obtain charging pile data in the charging pile system;

[0104] Specifically, the charging pile data may include charging pile network traffic, security logs, surveillance videos and other data, which are connected into a data set.

[0105] in,

[0106] 1) Charging pile network traffic refers to various data packets transmitted through the network. By analyzing the industrial control network traffic, abnormal network traffic can be detected, such as attack traffic, malware propagation, etc.

[0107] 2) Security log data: Security log data includes security log records of various network devices and systems.

[0108] S2. Perform numerical processing on the charging pile data to obtain numerical data of the charging pile corresponding to the charging pile data;

[0109] S3. Normalize the numerical data of the charging pile to obtain the charging characteristics, and map the numerical value of the charging pile to the interval [0,1]. The formula is as follows:

[0110]

[0111] Among them, X' is the normalized numerical feature vector, and X is the numerical feature vector before normalization.

[0112] It should be noted that the above S2-S3 are steps of performing parameter initialization and preprocessing operations on the charging pile network observation data set and selecting the features of the data set.

[0113] The steps specifically include the following steps:

[0114] A1. Numerical processing is performed on the data to be tested to obtain a numerical feature vector;

[0115] A2. Normalize the numerical feature vector to obtain normalized numerical features.

[0116] The above steps A1 and A2 correspond to steps S1 and S2 respectively.

[0117] It should be noted that, through standardization, since the numerical feature vectors have inconsistent feature scales in different dimensions, if they are not standardized, the model may be too sensitive to certain features, thus affecting the reliability and stability of the model. In order to convert all features to the same scale, the data should be standardized to facilitate better analysis and comparison. The standardized data maintains the same linear distribution relationship as the original data, which is conducive to improving the convergence speed and accuracy of the model. Therefore, the features are normalized and the numerical values ​​of the macro parameters of the industrial control network security data are mapped in the interval [0,1].

[0118] S4. Determine the distances corresponding to the charging features and the multiple target cluster center features, respectively, to obtain multiple target distances, wherein the multiple target cluster center features are obtained based on the multiple initial cluster center features, the multiple initial cluster center features are obtained based on the subsample features included in the corresponding update subspaces, the multiple update subspaces are subspaces whose corresponding sample densities are greater than the first threshold value determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features;

[0119] S5. Determine the attack behavior category corresponding to the charging pile system based on multiple target distances.

[0120] It should be noted that after determining the type of charging pile network attack behavior, an abnormal data detection report is generated, which includes the specific attack behavior category and the initial charging pile parameters corresponding to the charging pile system. After inputting the charging pile data and determining the type of charging pile network attack behavior based on the improved clustering algorithm, an abnormal data detection report is generated. Based on the report, the improved gray wolf optimization algorithm can be used to automatically respond, adjust the initial charging pile parameters, and determine the target charging pile parameters of the charging pile, so as to better defend against this type of attack.

[0121] Figure 3 is a flow chart of an improved multi-cluster charging pile network attack security protection system provided by an optional embodiment of the present invention, such as Figure 3 As shown, steps S6-S8 record the process of determining the target charging pile parameters of the charging pile, which is introduced below:

[0122] S6. Determine the initial charging pile parameters corresponding to the charging pile system;

[0123] S7. Determine a fitness function based on multiple target distances, wherein the fitness function is used to determine the probability that the charging pile system is attacked by the attack behavior category;

[0124] Specifically, the following steps may be included:

[0125] C1. Design fitness function:

[0126] The initial parameters of the charging pile and the target distance D corresponding to the charging pile under network attack can be determined based on the generated abnormal data detection report. a(i) ;

[0127] According to the target distance D a(i) , design the fitness function:

[0128] Design the fitness function f(x c ,y c )for:

[0129]

[0130] Among them, D s(i) Indicates the target distance corresponding to the target parameter determined subsequently, σ is a positive number between 0 and 0.05. is the correction item;

[0131] It should be noted that an optional implementation of the present invention adds partial information of the optimal individual gray wolf when designing the fitness function, which can solve the problems of information distortion and information loss generated during the iteration process when the population base is too large, and better identify charging pile network attack behaviors.

[0132] S8. Determine a predetermined number of charging pile parameters to be selected based on the initial charging pile parameters and the fitness function, wherein the predetermined number of charging pile parameters to be selected are all parameters whose corresponding fitness is greater than a second threshold;

[0133] S9. Obtain target charging pile parameters based on a predetermined number of charging pile parameters to be selected.

[0134] The specific execution method of the above steps S8-S9 can be as follows:

[0135] Specifically, the following steps may be included:

[0136] C2. Population exploration and iteration:

[0137] Figure 4 is a flow chart of an improved gray wolf optimization algorithm provided by an optional implementation mode of the present invention, such as Figure 4 As shown, first initialize the gray wolf population, assuming that the population size is k, T is the number of iterations, and use the chaotic vector m k Generate the initial reverse solution X k :

[0138] x k =x min +m k (x max -x min )

[0139] X k =(x max +x min )·rand()-x k

[0140] x max and x min Corresponding to the maximum and minimum values ​​of the corresponding dimensions of the population, X k Indicates the initialization position of the gray wolf population, rand() is a random number between [0,1], thus obtaining the initialized gray wolf population.

[0141] According to the previously determined fitness function, determine the fitness of the gray wolf individuals. At the same time, use the greedy algorithm to select the gray wolf individuals and save the first two wolves α and β with the best fitness. The positions of other gray wolves are jointly determined by the positions of α and β:

[0142]

[0143] in, represents point-to-point multiplication, and Levy represents the path that obeys the Levy distribution. Based on the above algorithm, update the current position of the gray wolf.

[0144] According to the current position of the gray wolf, the fitness of all gray wolves is re-determined. The gray wolf algorithm and Levy flight strategy are used to iterate the gray wolf population. In the D-dimensional search space, the position of the k-th gray wolf individual at the t-th iteration is represented by X k (t), using X α (t) represents the optimal solution:

[0145] D=|C·X p (t)-X k，(t) |

[0146] X k (t+1)=X p (t)-A·D

[0147] Where D is the search step length, X p (t) is the current prey position, X k (t+1) is the updated position of the current individual, A and C are disturbance factors, and the disturbance factor of the leader gray wolf is defined as follows:

[0148]

[0149] Among them, a is the nonlinear convergence factor. Assuming the disturbance factors of α wolf and β wolf are A1, A2 and C1, C2, their position update formula is:

[0150]

[0151] Among them, Dα , D β are the search steps of α wolf and β wolf respectively.

[0152] A new generation of population is generated through the Levy flight strategy. The specific parameters of the Levy flight strategy are set as follows:

[0153]

[0154] Among them, the parameter β is a random number in [0,2], and μ and ν follow a normal distribution: The value of λ gradually decreases from 1 to 0 as the number of iterations increases, and when the maximum number of iterations is reached, the target charging pile parameters are obtained.

[0155] C3: Automatic adjustment of charging pile system parameters:

[0156] The charging pile system automatically locates abnormal nodes, that is, abnormal parameters, according to the search process of the improved grey wolf algorithm, and responds to the abnormal nodes, that is, adjusts the initial charging pile parameters corresponding to the charging pile system to obtain the target charging pile parameters.

[0157] It should be noted that the optional implementation method of the present invention introduces chaotic mapping, flight strategy and mutation strategy on the basis of the gray wolf optimization algorithm, and the improved gray wolf optimization algorithm proposed has the advantages of relatively simple implementation, strong global convergence, fast convergence speed and good adaptability.

[0158] It should be noted that, before step S4, an operation of determining a plurality of target cluster centers is also included.

[0159] Specifically, the improved K-means clustering algorithm can be used to cluster the data, and the improved evidence accumulation clustering algorithm can be used to calculate the cumulative Markov distance from the isolated point to the cluster center, which is introduced below.

[0160] S401, determining a plurality of initial sample densities corresponding to a plurality of initial subspaces respectively;

[0161] Specifically, the improved K-means clustering algorithm can be used to perform clustering and classification operations on each space in the following way:

[0162] The charging characteristics corresponding to the charging pile system are used as the input data set of the improved K-means clustering algorithm, where the data sample to be clustered is X', the number of data samples is n, the dimension is m, and the spatial range is R N ;

[0163] x={X' i |x i ∈r N ,I=1,2,...,n}

[0164] Define the subspace r(r∈R N ) represents the number of samples in the subspace, expressed as ρ r If the sample density of the subspace is not less than ρ m i n , then the subspace is a high-density subspace, ρ m i n is the threshold of high density subspace.

[0165] Set the number of clusters k and the first threshold ρ min ;

[0166] Determine multiple initial subspaces: Select a positive integer l and divide the m-dimensional space where multiple charging features are located into l m (l m >2k)-dimensional initial subspace, ρ r Represents the initial sample density corresponding to multiple initial subspaces;

[0167] Then determine the initial sample density of each initial subspace

[0168] S402, comparing the multiple initial sample densities with the first threshold respectively to obtain multiple comparison results, wherein the multiple comparison results correspond to the multiple initial sample densities one by one;

[0169] S403, determining, from the multiple comparison results, multiple target results of the subspace whose corresponding initial sample density is greater than a first threshold;

[0170] S404: Determine that the initial subspaces corresponding to the multiple target results are multiple update subspaces.

[0171] Specifically, the following method can be used: determine multiple update subspaces from multiple initial subspaces: set the initial sample density to be no less than ρ min The initial subspace is put into the updated subspace set D ρ In the above example, the number of updated subspaces is counted. If the number of updated subspaces is less than the number of clusters k, the first threshold ρ is adjusted by returning to step 1. min ;

[0172] S405, determining the densest subspace with the highest sample density from the multiple updated subspaces;

[0173] S406, determining a first initial cluster center feature according to the average distance of charging pile sample points in the densest subspace;

[0174] S407, determining a plurality of initial distances corresponding to the first initial cluster center feature and the centers of a plurality of first residual subspaces, wherein the plurality of first residual subspaces are the remaining subspaces in the plurality of updated subspaces except for the densest subspace;

[0175] Specifically, the distance from c1 to the central features of other updated subspaces can be determined to obtain multiple initial distances;

[0176] S408, determining the long-distance subspace farthest from the first initial cluster center feature according to the multiple initial distances;

[0177] Specifically, we can select the update subspace farthest from c1 and calculate the average distance of charging features in the space;

[0178] S409, determining a second initial cluster center feature according to the average distance of the charging pile sample points in the long-distance subspace;

[0179] Specifically, the second initial cluster center feature c2 may be determined;

[0180] S410, determining first distances between the first initial cluster center feature and a plurality of second residual subspace centers, and determining a plurality of second distances between the second initial cluster center feature and a plurality of second residual subspace centers, wherein the plurality of second residual subspace centers are the remaining subspaces in the plurality of updated subspaces except for the densest subspace and the distant subspace;

[0181] S411, determining the distance sums of a plurality of first distances and the corresponding second distances, to obtain a plurality of distance sums;

[0182] Specifically, the sum of the distances from c1 and c2 to the center features of other updated subspaces can be determined, and the maximum distance and the corresponding updated subspace can be selected to obtain the initial cluster center feature c3;

[0183] The distance x1(α1,α2,...,α m ) and x2(β1,β2,...,β m ) is defined as:

[0184]

[0185] S412. Determine a third initial cluster center feature based on the multiple distance sums, until multiple initial cluster center features are determined, wherein the third initial cluster center feature is the updated subspace center corresponding to the maximum distance sum.

[0186] Specifically, the above steps can be performed to continue searching for cluster center features until the kth cluster center feature is found;

[0187] It should be noted that the cluster set output from the second stage, that is, the above-mentioned multiple initial cluster center features, is used as the input object of this stage, and the density decomposition method is used as the clustering and joint operation strategy of the improved evidence accumulation clustering algorithm to obtain multiple target cluster center features.

[0188] S413, from the multiple initial subspaces, determining a subspace whose corresponding initial sample density is less than or equal to a first threshold, to obtain a centerless subspace;

[0189] Specifically, it is possible to determine from multiple initial subspaces that the corresponding initial sample density is less than or equal to ρ min The subspace of , we get the centerless subspace;

[0190] Among them, clustering multiple charging features in the centerless subspace to the updated subspace corresponding to the nearest initial cluster center feature can be achieved through the traditional K-means clustering algorithm, and obtaining multiple target cluster center features according to multiple target subspaces can be completed by using the density decomposition method as the clustering and joint operation strategy of the improved evidence accumulation clustering algorithm;

[0191] S414, determining sample distances between a plurality of charging pile sample points included in the centerless subspace and a plurality of initial cluster center features;

[0192] Assume that the dimension of the sample space set R is m, and the data sample points are y = {y1, y2, ..., y m} and z={z1,z2,...,z m}, then the distance between sampling point y and sampling point z is calculated as:

[0193]

[0194] Among them, CM -1 is the covariance standard matrix, are the corresponding coordinate vectors respectively.

[0195] S415. Based on multiple sample distances, cluster multiple charging pile sample points into corresponding update subspaces to obtain multiple target subspaces;

[0196] Specifically, a distance threshold may be set according to the actual environment, and multiple target distances D corresponding to the charging characteristics are compared with the distance threshold to obtain multiple comparison results, and the charging pile network attack behavior is judged through the multiple comparison results.

[0197] S416. Obtain multiple target cluster center features based on multiple target subspaces, wherein the target subspaces correspond to the target cluster center features one by one.

[0198] Through the above optional implementation, at least the following beneficial effects can be achieved:

[0199] (1) Perform numerical processing on the charging pile data to obtain the numerical data of the charging pile corresponding to the charging pile data, which is convenient for subsequent analysis and comparison; perform normalization processing on the numerical data of the charging pile so that the numerical feature vector has a consistent feature scale, thereby improving the convergence speed and accuracy of the subsequent algorithm;

[0200] (2) Select the densest subspace, determine the average distance of the charging features in the densest subspace, and determine its central feature as the first initial clustering central feature. Since the subspace with the largest sample density includes the most charging features, the central feature determined in this way is representative and can better capture the clustering characteristics and structure of the data, thereby improving the accuracy and quality of clustering;

[0201] (3) Determine the sum of the distances from c1 and c2 to the center features of other updated subspaces, select the maximum distance and the corresponding updated subspace, and obtain the initial cluster center feature c3. In this way, the distances between different clusters are maximized, so that the center features of each cluster are evenly distributed in the data space, which is conducive to better representing different cluster groups and increasing the stability and accuracy of the detection results.

[0202] (4) Determine multiple distances from multiple charging features in the centerless subspace to multiple initial cluster center features, cluster the multiple charging features in the centerless subspace into the updated subspace corresponding to the initial cluster center feature with the closest distance, and obtain multiple target subspaces; obtain multiple target cluster center features based on the multiple target subspaces, and re-cluster the multiple charging features in the centerless subspace to make the clustering results more complete and accurate. Since the re-clustering causes the center feature of the target subspace to shift, it is necessary to re-determine the center feature so that the target cluster center feature better represents the respective clustering groups, optimizes the clustering results, and improves the clustering quality;

[0203] (5) Set the distance threshold according to the actual environment. Compare multiple target distances D corresponding to the charging characteristics with the distance threshold to obtain multiple comparison results. Through the multiple comparison results, accurately determine whether there is an attack in the charging pile network and the type of network attack behavior;

[0204] (6) Based on the category of attack behavior, the initial charging pile parameters are adjusted, and the positioning problem of the attack node is mapped to the gray wolf foraging process. The gray wolf individuals are selected through the improved fitness function and greedy algorithm. The gray wolf population is updated through the improved gray wolf algorithm and Levy flight strategy, and the target charging pile parameters are obtained, so that the charging pile system can automatically respond to network attack behaviors.

[0205] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0206] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of various embodiments of the present invention.

[0207] Example 2

[0208] According to an embodiment of the present invention, a device for implementing the above-mentioned method for determining attack behavior of a charging pile network is also provided. Figure 5 is a structural block diagram of an attack behavior determination device for a charging pile network according to an embodiment of the present invention, such as Figure 5 As shown, the device includes: an acquisition module 502, an extraction module 504, a first determination module 506 and a second determination module 508. The device is described in detail below.

[0209] An acquisition module 502 is used to acquire charging pile data in a charging pile system; an extraction module 504 is connected to the acquisition module 502 and is used to extract charging features corresponding to the charging pile data; a first determination module 506 is connected to the extraction module 504 and is used to determine the distances between the charging features and the multiple target cluster center features, respectively, to obtain multiple target distances, wherein the multiple target cluster center features are obtained based on multiple initial cluster center features, and the multiple initial cluster center features are obtained based on the sub-sample features included in the corresponding update subspace, and the multiple update subspaces are subspaces whose corresponding sample densities are greater than a first threshold value determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features; a second determination module 508 is connected to the first determination module 506 and is used to determine the attack behavior category corresponding to the charging pile system based on the multiple target distances.

[0210] It should be noted here that the above-mentioned acquisition module 502, extraction module 504, first determination module 506 and second determination module 508 correspond to steps S102 to S108 in the method for determining attack behavior of the charging pile network, and the examples and application scenarios implemented by the multiple modules are the same as the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0211] Example 3

[0212] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute instructions to implement any of the above-mentioned methods for determining attack behavior of a charging pile network.

[0213] Example 4

[0214] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the above-mentioned methods for determining attack behaviors of a charging pile network.

[0215] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0216] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0217] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0218] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0219] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0220] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0221] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for determining attack behavior of a charging pile network, characterized in that: include: Obtain charging pile data in the charging pile system; Extracting charging features corresponding to the charging pile data; Determine the distances between the charging features and the multiple target cluster center features, respectively, to obtain multiple target distances, wherein the multiple target cluster center features are obtained based on multiple initial cluster center features, the multiple initial cluster center features are obtained based on subsample features included in the corresponding update subspaces, the multiple update subspaces are subspaces whose corresponding sample densities are greater than a first threshold value determined from the multiple initial subspaces, and the multiple initial subspaces are obtained by clustering the target sample features; According to the multiple target distances, an attack behavior category corresponding to the charging pile system is determined.

2. The method according to claim 1, characterized in that Before determining the distances corresponding to the charging features and the multiple target cluster center features respectively and obtaining the multiple target distances, the method further includes: Determine a plurality of initial sample densities corresponding to the plurality of initial subspaces respectively; Comparing the multiple initial sample densities with the first threshold respectively to obtain multiple comparison results, wherein the multiple comparison results correspond to the multiple initial sample densities one by one; From the plurality of comparison results, determining a plurality of target results of a subspace whose corresponding initial sample density is greater than a first threshold; Initial subspaces corresponding to the multiple target results are determined as the multiple updated subspaces.

3. The method according to claim 1, characterized in that Before determining the distances corresponding to the charging features and the multiple target cluster center features respectively and obtaining the multiple target distances, the method further includes: Determine, from the multiple updated subspaces, the densest subspace with the highest sample density; Determining a first initial cluster center feature according to an average distance of charging pile sample points in the densest subspace; Determine a plurality of initial distances corresponding to the first initial cluster center feature and a plurality of first residual subspace centers, wherein the plurality of first residual subspaces are the remaining subspaces in the plurality of updated subspaces except the most dense subspace; According to the multiple initial distances, a long-distance subspace with the farthest distance from the first initial cluster center feature is determined; Determining a second initial cluster center feature according to an average distance of charging pile sample points in the long-distance subspace; Determine first distances between the first initial cluster center feature and a plurality of second residual subspace centers, and determine a plurality of second distances between the second initial cluster center feature and a plurality of second residual subspace centers, wherein the plurality of second residual subspace centers are the remaining subspaces in the plurality of updated subspaces except the densest subspace and the distant subspace; Determine the distance sums of the plurality of first distances and the corresponding second distances, respectively, to obtain a plurality of distance sums; A third initial cluster center feature is determined according to the multiple distance sums, until the multiple initial cluster center features are determined, wherein the third initial cluster center feature is the updated subspace center corresponding to the maximum distance sum.

4. The method according to claim 1, characterized in that: Before determining the distances corresponding to the charging features and the multiple target cluster center features respectively and obtaining the multiple target distances, the method further includes: Determine, from the multiple initial subspaces, a subspace whose corresponding initial sample density is less than or equal to a first threshold, to obtain a centerless subspace; Determine sample distances between a plurality of charging pile sample points included in the centerless subspace and a plurality of initial cluster center features; Based on multiple sample distances, the multiple charging pile sample points are clustered into corresponding update subspaces to obtain multiple target subspaces; Based on the multiple target subspaces, multiple target cluster center features are obtained, wherein the target subspaces correspond to the target cluster center features one by one.

5. The method according to claim 1, characterized in that: After determining the attack behavior category corresponding to the charging pile system according to the multiple target distances, the method further includes: Determining initial charging pile parameters corresponding to the charging pile system; Based on the attack behavior category, the initial charging pile parameters are adjusted to obtain target charging pile parameters.

6. The method according to claim 5, characterized in that Based on the attack behavior category, adjusting the initial charging pile parameters to obtain target charging pile parameters includes: Determining a fitness function according to the multiple target distances, wherein the fitness function is used to determine the probability that the charging pile system is attacked by the attack behavior category; Determining a predetermined number of charging pile parameters to be selected according to the initial charging pile parameters and the fitness function, wherein the predetermined number of charging pile parameters to be selected are all parameters whose corresponding fitness is greater than a second threshold; The target charging pile parameters are obtained according to the predetermined number of charging pile parameters to be selected.

7. The method according to any one of claims 1 to 6, characterized in that: Extract charging characteristics corresponding to charging pile data, including: Performing numerical processing on the charging pile data to obtain numerical charging pile data corresponding to the charging pile data; The numerical data of the charging pile is normalized to obtain the charging characteristics.

8. A device for determining attack behavior of a charging pile network, characterized in that: include: An acquisition module, used to acquire charging pile data in the charging pile system; An extraction module, used to extract charging features corresponding to charging pile data; A first determination module is used to determine the distances corresponding to the charging features and a plurality of target cluster center features, respectively, to obtain a plurality of target distances, wherein the plurality of target cluster center features are obtained based on a plurality of initial cluster center features, the plurality of initial cluster center features are obtained based on subsample features included in a corresponding update subspace, the plurality of update subspaces are subspaces whose corresponding sample densities are greater than a first threshold value determined from a plurality of initial subspaces, and the plurality of initial subspaces are obtained by clustering target sample features; The second determination module is used to determine the attack behavior category corresponding to the charging pile system according to the multiple target distances.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method for determining attack behavior of a charging pile network as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method for determining attack behavior of a charging pile network as described in any one of claims 1 to 7.

Images